PT-2024-37449 · Zohocorp · Zoho Manageengine Exchange Reporter Plus

Minhgalaxy · Published 2024-08-30 · Updated 2024-09-19 · CVE-2024-6204

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine Exchange Reporter Plus versions before 5715

Description: The issue is related to SQL Injection in the reports module of the software. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations: For versions before 5715, update to a version 5715 or later to resolve the SQL Injection issue in the reports module. As a temporary workaround, consider restricting access to the reports module until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-6204

Affected Products

Zoho Manageengine Exchange Reporter Plus

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6204 · Security Note
• https://manageengine.com/products/exchange-reports/advisory/CVE-2024-6204.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6204 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1829591885440008647 · Twitter Post
• https://t.me/cvenotify/92887 · Telegram Post
• https://twitter.com/CveFindCom/status/1829572847435411526 · Twitter Post
• https://t.me/cvedetector/4534 · Telegram Post
• https://twitter.com/cracbot/status/1831210656542195872 · Twitter Post
• https://twitter.com/CVEnew/status/1829572575938134397 · Twitter Post